Search Images Maps Play YouTube News Gmail Drive More »
Sign in
Screen reader users: click this link for accessible mode. Accessible mode has the same essential features but works better with your reader.

Patents

  1. Advanced Patent Search
Publication numberUS6209104 B1
Publication typeGrant
Application numberUS 08/980,748
Publication dateMar 27, 2001
Filing dateDec 1, 1997
Priority dateDec 10, 1996
Fee statusPaid
Publication number08980748, 980748, US 6209104 B1, US 6209104B1, US-B1-6209104, US6209104 B1, US6209104B1
InventorsReza Jalili
Original AssigneeReza Jalili
Export CitationBiBTeX, EndNote, RefMan
External Links: USPTO, USPTO Assignment, Espacenet
Secure data entry and visual authentication system and method
US 6209104 B1
Abstract
The present invention is a secure data entry and visual authentication system that allows a user to securely input and communicate data, including passwords. The system includes a client subsystem (100), a server subsystem (200) and a communication subsystem (300). Server subsystem (200) generates a pseudorandomly arranged display image (250) including a plurality of icons associated with data, and transmits said display image to client subsystem (100) for display on a display device (104). A user consecutively selects at least one said icons corresponding to data desired to be input. Selected icon location information for those selected icons is communicated by client subsystem (100) to server subsystem (200), which then compares that selected icon location information to icon location information and associated data stored in memory (210) to ascertain the data input by the user.
Images(12)
Previous page
Next page
Claims(31)
What is claimed is:
1. A secure data entry system for entering data into a computer-based system, comprising:
a server subsystem adapted for generating display image information for a display image, said display image containing a plurality of icons, at least one of said plurality of icons being associated with corresponding icon location information within said display image and with data, said server subsystem including means for processing said display image information, means for storing said icon location information and said associated data for said display image, means for comparing said icon location information with selected icon location information associated with input data, and means for varying the icon location information for display images generated;
a client subsystem adapted for generating said display image from said display image information, said client subsystem including means for generating said display image, means for displaying said display image, and means for receiving input data from a user, including selection by said user of at least one of said plurality of icons within said display image; and
means for communicating said display image information from said server subsystem to said client subsystem and icon location information for said selected at least one icon from said client subsystem to said server subsystem; said server subsystem comparing said selected icon location information to said stored icon location information and associated data for said display image in said server subsystem.
2. The secure data entry system as claimed in claim 1, wherein said user selects said at least one of the plurality of icons by selecting at least one point location in said display image corresponding to said at least one icon.
3. The secure data entry system as claimed in claim 1, wherein said plurality of icons are pseudorandomly arranged in said display image.
4. The secure data entry system as claimed in claim 1, wherein said input data comprises password information.
5. The secure data entry system as claimed in claim 1, wherein said plurality of icons comprises random shapes and sizes.
6. The secure data entry system as claimed in claim 1, wherein said plurality of icons represents concepts.
7. The secure data entry system as claimed in claim 1, wherein at least one of said plurality of icons includes at least one alphanumeric indicia.
8. The secure data entry system as claimed in claim 1, wherein said display image information comprises said display image and said means for generating a display image in said client subsystem comprising functionality for receiving said display image and delivering it in proper format to said means for displaying said display image.
9. The secure data entry system as claimed in claim 1, wherein said display image information comprises icon location information.
10. The secure data entry system as claimed in claim 1, wherein said display image information comprises instructions for the generation of said display image.
11. The secure data entry system as claimed in claim 1, wherein said icons are preselected by said user and stored in said server subsystem.
12. The secure data entry system as claimed in claim 1, wherein said server subsystem comprises a first computer subsystem and said client subsystem comprises a second computer subsystem.
13. A secure data entry system for entering data into a computer-based system, comprising:
a first computer-based subsystem adapted for generating display image information for a display image, each said display image containing a plurality of icons, at least one of said plurality of icons being associated with corresponding icon location information within said display image and with data, said first computer-based subsystem including a memory capable of storing said icon location information and said associated data for said display image, and further adapted for comparing said icon location information with location information associated with said input data and for varying the icon location information for display images generated;
a second computer-based subsystem adapted for generating said display image from said display image information, for displaying said display image, and for receiving input data from a user, said input data including selection by said user of at least one icon from said plurality of icons within said display image; and
a communications subsystem for communicating said display image information from said first computer-based subsystem to said second computer-based subsystem and icon location information for said selected at least one icon from said second computer-based subsystem to said first computer-based subsystem; said first computer-based subsystem comparing said selected icon location information to said stored icon location information and associated data for said display image.
14. A secure data entry system for entering input data into a computer-based system, said data entry system comprising:
a first computer-based subsystem adapted for generating icon location information for a display image, said icon location information for said display image associated with at least one of a plurality of icons contained in said display image, and further associated with data, said first computer-based subsystem being further adapted for storing said icon location information and associated data for said display image, and for varying the icon location information for display images generated;
a second computer-based subsystem adapted for generating said display image from said icon location information, for displaying said display image and for receiving input data from a user, including selection of at least one icon from said display image; and
a communications subsystem for communicating said icon location information from said first computer-based subsystem to said second computer-based subsystem, and icon location information for said selected at least one icon from said second computer-based subsystem to said first computer-based subsystem, said first computer-based subsystem comparing said selected icon location information to said stored icon location information and associated data.
15. The secure data entry system as claimed in claim 14, further comprising an image synchronization mechanism for synchronizing said icon location information between said first computer-based subsystem and said second computer-based subsystem.
16. The secure data entry system as claimed in claim 15, wherein said image synchronization mechanism is comprised of pseudorandom number generators in each of said first computer-based subsystem and said second computer-based subsystem.
17. A server subsystem for a secure data entry system, said server subsystem comprising:
means for generating display image information for a display image, said display image containing a plurality of icons, at least one of said plurality of icons being associated with corresponding icon location information within said display image, and further associated with data;
means for storing said icon location information and said associated data for said display image;
means for comparing said stored icon location information with selected icon location information received from a client subsystem by means of a commmunications subsystem, said selected icon location information reflecting selection of at least one icon from said display image by a user through said client subsystem, and said communications subsystem transmitting said display image information from said server subsystem to said client subsystem, and said selected icon location information from said client subsystem to said server subsystem for comparison with said stored icon location information and associated data for said display image; and
means for varying the icon location information for display images generated.
18. A client subsystem for a secure data entry system, said client subsystem comprising:
means for generating display images from display image information received from a server subsystem for each said display image, each said display image containing a plurality of icons, at least one of said plurality of icons being associated with corresponding icon location information within said display image and further associated with data, said server subsystem varying the icon location information for display images generated;
means for displaying said display image;
means for receiving input data from a user, including selection by said user of at least one of said plurality of icons within said display image; and
means for transmitting over a communications subsystem said selected icon location information to said server subsystem, for comparison with said at least one icon associated with corresponding icon location information and associated data for said display.
19. A communications subsystem for a secure data entry system, comprising:
means for communicating display image information for display images from a server subsystem to a client subsystem, and for communicating selected icon location information from said client subsystem to said server subsystem;
each said display image containing a plurality of icons, at least one of said plurality of icons being associated with corresponding icon location information within said display image and further associated with data;
said client subsystem generating said display image from said display image information, displaying said display image, receiving input from a user, including selection by said user of at least one icon from said plurality of icons within said display image; and
said server subsystem comparing said selected icon location information with said icon location information and data associated with said display image, and varying the icon location information for display images generated.
20. A method for entering data into a secure data entry system for a computer-based system, comprising:
(a) generating a display image, said display image containing a plurality of icons;
(b) associating at least one of said plurality of icons with corresponding icon location information within said display image, and with data;
(c) displaying said display image;
(d) receiving input data from a user reflecting said user's selection of at least one icon from said plurality of icons in said display image;
(e) comparing said selected icon location information to said associated icon location information and associated data for said display image; and
(f) repeating steps (a) through (e) for a plurality of display images and at least one user, wherein the icon location information associated with said plurality of icons is varied for display images generated;
wherein at least one of the steps of the method is performed in a server subsystem of the computer-based system and the other steps are performed in a client subsystem of the computer-based system, said server subsystem and said client subsystem communicating by means of a communications subsystem.
21. A method for entering input data into a server subsystem of a secure data entry system, comprising:
(a) generating display image information for a display image, said display image containing a plurality of icons;
(b) associating at least one of said plurality of icons with corresponding icon location information within said display image, and with data;
(c) receiving from a client subsystem, by means of a communications subsystem, icon location information reflecting selection by a user of at least one of said plurality of icons;
(d) comparing said selected icon location information to said associated icon location information and associated data for said display image; and
(e) repeating steps (a) through (d) for any user, wherein the icon location information associated with said at least one icon is varied for display images generated.
22. The method of claim 21, wherein steps (a), (b) and (d) are performed in a server subsystem of a secure data entry system, step (c) is performed in a client subsystem of a secure data entry system, said display image information is transmitted from said server subsystem to said client subsystem, and said selected icon location information is transmitted from said client subsystem to said server subsystem for said comparison.
23. A method for entering data into a client subsystem of a secure data entry system, comprising:
(a) receiving display image information for a display image from a server subsystem of said secure data entry system, said display image containing a plurality of icons, at least one of said plurality of icons being associated with corresponding icon location information within said display image and associated with data;
(b) generating said display image;
(c) displaying said display image;
(d) receiving input data from a user, said input data reflecting said user's selection of at least one of said plurality of icons;
(e) transmitting said selected icon location information corresponding to said selection by said user of at least one of said plurality of icons from said display image to said server subsystem for comparison with said associated icon location information and associated data for said display image; and
(f) repeating steps (a) through (e) for any user, wherein the icon location information associated with said at least one icon is varied for display images generated.
24. A method for transmitting data in a communications subsystem of a secure data entry system, comprising:
(a) receiving display image information for transmission, said display image information corresponding to a display image containing a plurality of icons, at least one of said plurality of icons having icon location information for said display image associated with it, and further associated with data;
(b) transmitting said display image information;
(c) receiving icon location information for at least one icon selected by a user from said plurality of icons within said display image; and
(d) repeating steps (a) through (c), wherein the icon location information associated with said at least one of said plurality of icons is varied for display images generated.
25. The method of claim 24, wherein said display image of step (a) is received from a server subsystem of said secure data entry system, said display image is transmitted in step (b) to a client subsystem of said secure data entry system, and said selected icon location information in step (c) is received from said client subsystem, and transmitted to said server subsystem.
26. A method for entering password data into a computer-based system comprising:
(a) receiving from a user a password and icon information for at least one icon corresponding to said password;
(b) storing said password and said associated icon information;
(c) generating display image information for a display image, said display image containing a plurality of icons, at least one of said plurality of icons corresponding to said password;
(d) generating said display image;
(e) displaying said display image;
(f) receiving input data from a user, including identification information for that user and selection of at least one of said plurality of icons in said display image;
(g) comparing said selected icon location information to said stored icon location information and said associated password data for said display image;
(h) repeating steps (c) through (g) until all of the at least one icon associated with said password have been displayed to said user; and
(i) repeating steps (c) through (h) for any user, wherein the icon location information associated with said at least one icon corresponding to said password is varied for display images generated;
wherein at least one of the steps of the method is performed in a server subsystem of the computer-based system and the other steps are performed in a client subsystem of the computer-based system, said server subsystem and said client subsystem communicating by means of a communications subsystem.
27. The method of claim 26, wherein said icon information comprises information for incorporation of said at least one icon corresponding to said password in display images.
28. A method for entering password data into a computer-based system comprising:
(a) receiving from a client subsystem a password and icon information for at least one icon corresponding to that password;
(b) storing said password and said icon information;
(c) generating display image information for a display image, said display image containing a plurality of icons, said plurality of icons containing at least one of said at least one icon corresponding to said password;
(d) generating said display image;
(e) displaying said display image;
(f) receiving input data from a user, including selection by said user of identification information for that user and selection of at least one of said plurality of icons in said display image;
(g) generating selected icon location information corresponding to said selection of at least one icon from said display image by said user;
(h) comparing said selected icon location information. to said stored icon information and said associated password;
(i) repeating steps (c) through (h) until all of the at least one icon associated with said password have been displayed to said user; and
(j) repeating steps (c) through (i) for a user, wherein the icon location information associated with said at least one icon corresponding to said password is varied for display images generated.
29. The method of claim 28 wherein at least one step is performed in a server subsystem of said secure data entry system and the remaining steps are performed in a client subsystem of said secure data entry system.
30. A method for entering password data into a server subsystem of a computer-based system comprising:
(a) receiving a password and icon information for at least one icon corresponding to that password for a user;
(b) storing said password and said icon information;
(c) generating display image information for a display image, said display image containing a plurality of icons, said plurality of icons containing at least one of said at least one icon corresponding to said password;
(d) transmitting said display image information to a client subsystem;
(e) receiving from said client subsystem input data for a user, including selected icon location information corresponding to selection by said user of at least one of said plurality of icons in said display image;
(f) comparing said selected icon location information to said stored icon information and said associated password;
(g) repeating steps (c) through (f) until all of the at least one icon associated with said password have been displayed to said user; and
(h) repeating steps (c) through (g) for a user, wherein the icon location information associated with said at least one icon corresponding to said password is varied for display images generated.
31. A method for entering password data into a client subsystem of a computer-based system comprising:
(a) receiving a password and icon information for at least one icon corresponding to that password for a user;
(b) transmitting said password and said icon information to a server subsystem of said secure data entry system;
(c) receiving display image information for a display image, said display image containing a plurality of icons, said plurality of icons containing at least one of said at least one icon corresponding to said password;
(d) generating said display image from said display image information;
(e) receiving input data from a user, including selection by said user of at least one of said plurality of icons in said display image;
(f) transmitting selected icon location information to said server subsystem for comparison with stored icon information and said associated password;
(g) repeating steps (c) through (f) until all of the at least one icon associated with said password have been displayed to said user; and
(h) repeating steps (c) through (g) for a user, wherein the icon location information associated with said at least one icon corresponding to said password is varied for display images generated.
Description
CROSS-REFERENCE TO RELATED APPLICATION

This application is based on and claims priority from U.S. Provisional Patent Application Ser. No. 60/033,126 filed on Dec. 10, 1996.

FIELD OF THE INVENTION

The present invention is directed generally to a secure data entry and visual authentication system and, in particular, to a system and method that allows secure data and/or password entry to computer-based systems, such as for example, networked computer systems, automated teller machines (“ATMs”), online banking, calling card phone access, shopping and other information services.

BACKGROUND OF THE INVENTION

Systems are known that are designed to allow secure data entry and access to computer systems, ATMs, online services, and the like. For example, in an office computer environment with access to a computer network such as a wide area network (“WAN”) or a local area network (“LAN”), access by individual users to the computer network is often controlled by a password entry system. Such systems usually involve identifying the user to the network such as by entering the user's name or initials (often referred to as the “user ID”), and then entering a multi-digit alphanumeric password for that user. Entry of the user ID and password typically involves typing the alphanumeric characters that comprise the user ID or password. If the correct password corresponding to the identified user is entered, the user will be signed on to the network and allowed access, as appropriate.

In online applications, a user may seek to obtain access to a secure networked resource, such as a World Wide Web (“Web”) site on the Internet or other online service, in order to access online banking services or other information subject to restricted access. Additionally, a user might wish to shop for and purchase a product or service available via a Web site. In these online services examples, after the user is properly identified, an alphanumeric code or personal identification number (“PIN”) usually must be entered. If the code or PIN is correct, access will be granted. The online shopping example also presents another situation requiring secure data entry. There, a user may desire to enter a credit card number or similar information to make a purchase.

In an ATM system, a user typically will be provided with a card having a readable magnetic strip which identifies the user to the ATM network. A personal identification number, or PIN, must be entered by the user as the password in order to gain access to the user's account. The PIN is generally entered by a user through a numeric keypad. Once the PIN is verified, access to the user's bank accounts, including the withdrawal of cash, is permitted. Similarly, a person using a calling card on a payphone will enter his or her account number and PIN to place a phone call.

Systems such as the ones described above are susceptible to being compromised by the theft of, or otherwise unapproved access to, passwords and PINs. Online shopping applications are equally susceptible to having information such as credit card numbers pilfered. Two security problems for password and other data entry systems are the “over-the-shoulder” problem and “interception.” The over-the-shoulder problem refers to the fact that direct keyboard entry of passwords and other data is susceptible to ready observation by a third party. This is particularly troublesome for ATMs, calling card operated phones and other systems which require the entry of passwords or other sensitive information in a public environment.

The “interception” problem refers to the fact passwords and other data are also susceptible to compromise during their transmission over computer networks. There are numerous cryptographic techniques known in the prior art for encrypting data to deter the unauthorized disclosure thereof if data is captured. Even with the use of encryption, however, the code can be broken or deciphered, the password can be learned, and the system can then be broken into. Moreover, increases in computing capabilities make encryption techniques susceptible to computational decryption techniques. In any event, once the user identification and password are obtained, illegal access to a given restricted resource may be readily gained by a third party. Additionally, various computer-based “observation” techniques are known for determining passwords. For example, a trojan horse program running on a user's computer can present an interface familiar to a user while stealthily recording that user's password without detection.

Various proposals have been suggested for other than alphanumeric entry of the password on a keyboard or pad. For example, Davies U.S. Pat. No. 5,608,387 proposes a system whereby slightly differing complex facial expressions or appearances in a matrix displayed on a screen are recognized visually by an authorized user to select a visually recognized facial image which represents the password. Davies addresses the over-the-shoulder problem by relying on the human ability to distinguish complex, subtle differences in facial expressions. Unlike Davies, the present invention does not require either complex images or false images. Additionally, it does not require that particular images be associated with each user.

Cottrell U.S. Pat. No. 5,465,084 also addresses the over-the-shoulder problem. Cottrell describes a system whereby a user is presented with a blank grid and selects a pattern of letters on a screen. This pattern is compared with a stored master pattern to determine whether a proper match of the pattern has been entered. Cottrell relies on the vast number of combinations possible by making positioning of password characters in more than one dimension and the color of the data elements possible components of the password. Cottrell requires that password characters be entered in a grid pattern.

Baker U.S. Pat. No. 5,428,349 is directed to a password entry system in which the password is embedded in various columns and rows which are then selected to indicate the password. In a representative embodiment of that invention, a user picks a six character column out of six such columns displayed on a screen that contains the proper character of a password. This is done for each character of the password. In this way, Baker provides deterrence against third party observation of the password and provides transmission protection. However, Baker is limited to always using an m×n grid, requires the user to select an entire column or row, and is subject to a logical deduction to a possible set of passwords.

Note also that Davies, Cottrell and Baker all are limited to a password entry function. None of the three may be used to provide a secure general data entry function whereby any data can be entered and transmitted.

What is needed is a system that is at once user-friendly, not readily susceptible to observation during data entry, and resistant to interception and computational deciphering techniques.

SUMMARY OF THE INVENTION

The present invention is directed to a method and system of secure data entry. In one embodiment of the present invention, the system includes a server subsystem capable of generating display images containing icons and having a memory which stores location information for the icons in each said display image as well as data associated with each icon, and a client subsystem including a display device on which the generated display images are displayed, randomly or otherwise. An input device connected to the client subsystem is used by a user to select at least one of said icons by selecting points on or proximate to the icons. A communications subsystem transmits this selected icon location information from the client subsystem to the server subsystem, and comparator functionality in the server subsystem compares the selected icon location information with the icon location information and associated data stored in the server subsystem to identify the data that was originally input by the user. The server subsystem is thus able to determine the input data that the user input into the client subsystem without directly exposing that data to observation or interception.

Under the method according to one aspect of the present invention, a user desiring access to a password-protected resource identifies himself to a computer-based resource server by entering a user ID, such as a name or initials, at a local node or other such client subsystem, such as the user's personal computer (“PC”), the PC being connected to the computer-based resource server by means of a computer network. If the server recognizes the user, the data elements that constitute the user's predetermined password, known to the user, is retrieved and displayed on the user's PC monitor in a display image containing icons in random order. The icons are associated with data in a way that is readily or intuitively discernable by the user. For example, instead of having a user input keypad digit “5” for the number 5 in a password, an icon consisting of 5 bowling pins together could appear on a display image (a commensurate number of bowling pins would be grouped in the icon corresponding to digit 0 through 9). A user would intuitively be able to determine that the five grouped bowling pins in said icon corresponds to the number “5” and, in a touch-screen application, for example, would touch that icon in order to input “5.”

The user selects the various icons associated with the alphanumeric characters making up the user's password. Location information associated with the selected icons—but not the actual password elements—is then communicated to the resource server. The selected icon location information may refer to specific points or to specific areas on the display image. The selection of any point within an area corresponding to a particular icon will result in the selection of that icon. The server then implements a comparator function which translates the selected icon location information into the alphanumeric characters represented by the selected icon location information and determines whether the user's password has been properly entered. If so, the user is allowed appropriate access to the password-protected resource.

In this fashion, the user's data in the above example, the password, is protected from theft during entry, as well as protected from interception during transmission. The data is protected during entry from thieves who observe touch screen keypad entry by varying the nature and locations of icons on the display as well as the correspondence between icons and keypad digits (in those implementations that use keypads) or the associated data. Someone observing entry of the location information by the user cannot readily determine the user's password only from keyboard entries or observation of the screen alone since the location of the icons is preferably randomized.

The data is also protected during communication between the client subsystem and server subsystem because the password or data is never transmitted—only location information for the selected icons that represent the password elements is transmitted. Thus, interception of such transmissions alone will not disclose the data. Additionally, the use of the icons associated with the alphanumeric or other elements of the password combats computational deciphering techniques that could be used on intercepted display images by visually encoding data such that visual inspection (or very advanced pattern recognition) techniques are required in order to determine password or data elements.

Accordingly, one object of the present invention is to provide a data entry system that is not easily susceptible to the over-the-shoulder problem (i.e., to password compromise by observation by a third party of the user's keyboard data entry).

Another object is to provide a data entry and transmission system that is not easily susceptible to interception by making it difficult to ascertain without visual inspection of the contents of displayed data in order to properly determine actual contents of the data.

Additional objects, advantages and novel features of the invention will be set forth in, and become apparent to those skilled in the art from the description which follows.

BRIEF DESCRIPTION OF THE DRAWINGS

For a fuller understanding of the invention, reference is had to the following description taken in connection with the accompanying drawings, in which:

FIG. 1 is a system architecture block diagram of an exemplary system embodying the present invention;

FIG. 2 is a block diagram depicting an exemplary client subsystem embodying the present invention;

FIG. 3 is a block diagram depicting an exemplary subsystem of the present invention;

FIG. 4 is a front plan view of a client subsystem display showing the manner in which icons may be displayed thereon;

FIG. 5 is a front plan view of a client subsystem display showing the manner in which icons may be displayed using intuitive but indirectly identifiable indicia;

FIG. 6 is a block diagram showing a preferred manner in which icon location information is identified by the server;

FIG. 7 is a block diagram showing a preferred manner in which icon location information is identified by a user;

FIG. 8 is a flow diagram showing a preferred method implemented according to the present invention;

FIG. 9 is a block diagram of an exemplary preferred embodiment of an online shopping application;

FIG. 10 is a block diagram of an exemplary preferred embodiment of a credit-card-operated phone system; and

FIG. 11 is a block diagram of an exemplary preferred embodiment of a smart-card-based implementation of the present invention.

FIG. 12 is a block diagram of an exemplary embodiment of the present invention incorporating a synchronization mechanism between the client subsystem and the server subsystem.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Preferred embodiments of a system built in accordance with the present invention will now be described with continued reference to the figures.

FIG. 1 depicts a secure data entry and visual authentication system, generally indicated at 80, constructed in accordance with a first embodiment of the present invention. System 80 includes a client subsystem 100 with which a user interacts, and a server subsystem 200 which controls access to a resource the user wishes to access. Client subsystem 100 communicates with server subsystem 200 over communications subsystem 300.

Client subsystem 100 may take various forms such as a desktop or laptop computer, an ATM, a credit-card-operated telephone, a generic key entry pad with visual display capable of displaying icons, or any other such system that includes a display device and an input device for entering data.

Server subsystem 200 also can take numerous forms, including, for example, a file server with which PCs, personal digital assistants (“PDAs”) or other devices can communicate. Another form server subsystem 200 may take is as a subsystem within an ATM or phone system or network. Other implementations are commonly known in the computer field.

The terms “client” and “server” as used herein are general and are not limited to so-called “client/server” systems. Thus, the system of the present invention may include any two communicating computers where at least one such computer controls a resource, such as might be implemented in a peer-to-peer system architecture.

Communications subsystem 300 may be implemented with one or more of many data communications systems generally known in the art, as may be suitable, such as a LAN, a WAN, plain old telephone service (“POTS”), cable systems, wireless systems such as cellular, satellite and personal communications services (“PCS”) systems, or by a dedicated connection.

Referring additionally to FIG. 2, it is seen that client subsystem 100 may include an input device 102, a display device 104 and an appropriate communications interface 106 which allows input data from input device 102 to be transmitted to server subsystem 200 depicted in FIG. 1. In this form, communications interface 106 might comprise a modem, network adapter or radio transmitter/receiver, or other such communications device, along with appropriate software.

Display device 104 may be any type of display capable of displaying various icons, such as a computer monitor including a cathode ray tube, flat panel displays incorporating liquid crystal (“LCD”), thin film transistor (“TFT”) field emission display (“FED”) or other display technology, and may comprise a touch-sensitive screen, or other technology. Input device 102 may be a pointing device such as a computer mouse, a light pen or other type stylus arrangement, a touch-sensitive screen, a computer keyboard or a keypad, or other such entry system that allows locations on display device 104 to be indicated.

Referring now additionally to FIG. 3, it is seen that server subsystem 200 preferably includes a server 202 which may control access, for example, to a resource 204, a database or file system 206, or a private communication channel 208. Server 202 also includes a memory 210, a comparator 214 and a communications interface 216 such as a modem or network adapter with appropriate software drivers that allows communication with client subsystem 100 (FIG. 1) over communications subsystem 300 (FIG. 2).

Generally speaking, when a user desires to gain access to the server subsystem 200 or to specific resources controlled thereby, the user must identify herself to the server subsystem 200 and enter an appropriate password to gain entry. In the usual situation, the password is in alphanumeric format and includes a sequence of several letters and/or numbers unique to that particular user. Any form of element may be used as a password element, such as for example numbers and letters, symbols, images and the like. If a third party observes entry of the password by the user, or intercepts transmission of the password, and is able to decipher and learn the password, such third party may gain access to the server subsystem 200 under that user's name. Additionally, if the data or password is intercepted during the process of transmission from the client subsystem 100 to the server subsystem 200 over communications subsystem 300, the data might be compromised.

In the present invention, the server subsystem 200 can receive data from the user, typically via a user interface on client subsystem 100, but without transmission of the data or password itself either from the server subsystem 200 to the client subsystem 100 or from the client subsystem 100 to the server subsystem 200. Moreover, entry of the data is done in a manner which enhances the security of that process.

Reference is now made additionally to FIGS. 4 through 6 for a description of the manner in which the present invention is preferably implemented and operated.

Preferably, when a user is identified to the server subsystem 200, the server subsystem 200 determines if the user is a recognized user. If so, the server subsystem 200 generates a display image 250, depicted in FIG. 4, bearing a group of icons i0-in 230, pseudorandomly arranged, arrayed or otherwise presented on the display device 104. Server 202 stores in memory 210 icon location information for each of the icons i0-in 230 such that the areas on the display image 250 that correspond to each of the icons i0-in 230 can be ascertained. Also stored in memory 210 is data associated with each of the icons i0-in 230. For example, if a particular display image 250 includes icons i0-in 230 corresponding to digits 0 to 9, memory 210 will have stored in it the digits such that the relationship of the icons, icon location information, and associated digits may be retrieved. A memory look up table can be used to store this information. Many other methods are known in the prior art.

Memory 210 may be implemented using random access memory (“RAM”), flash memory, disk drives or any other rewritable memory technology. In some applications, memory 210 may also be implemented using non-rewritable memory such as read only memory (“ROM”) chips.

Server 202 may generate the display image 250 by selecting, pseudorandomly, based on prior user selections, or otherwise, said icons i0-in 230 included in said display image 250. The background 251 for the display image 250 might be plain or contain one or more patterns in one or more combinations of colors. Alternatively, display image 250 might be pre-generated and stored in files or a database system. Other methods of generating display image 250 are known in the prior act. Display image 250 may be implemented as a bit mapped image, a raster image or in any other suitable image file format.

Display image 250 may also include keypad digits corresponding to each of the icons i0-in 230. The user inputs the keypad digit k corresponding to the icon ix desired. To improve the security of the overall system, the arrangement of the icons i0-in 230 in the generated display image 250 is preferably pseudorandomly varied with each server access request. In addition, the particular icon scheme presented in display image 250 may be varied with each use, such icons preferably being randomly displayed rather than arranged.

Each icon i0-in 230 may be a polygon, an image of some object, or any other form from which users can identify relevant data elements. The icon serves as an identifiable indicator of an element of the data or password to be entered. For example, icons in the form of different fruit may be displayed where a user's password consists of several fruit images. Other such non-alphanumeric, symbolic passwords may also be used.

Icons may also take intuitive forms from which the user can readily deduce the data element represented by the icon. FIG. 5 shows a display image 260 depicting icons representing digits 0 through 9 by images of groups of bowling pins. The number of pins within each icon serve as identifiable indicia to the user of the digit it represents. In an application implemented with a touch screen, the user would touch the screen where the icon for the desired digit is located in order to input that digit.

FIG. 6 shows a session list of icons placed in a display image. The server subsystem 200 preferably stores the location of each of the icons in a session list or look-up table in memory, such as a list 211, and transmits the display image 250 or display image 260, which may also include a background pattern 251 (FIG. 4) or background pattern 261 (FIG. 5), for display on device 104. The background patterns 251 and 261 make it more difficult for a third party to observe the icons from a distance, e.g. by peering over the user's head. Additionally, the background leaf pattern 261 may provide false edges in order to make it more difficult for pattern recognition algorithms that a party that intercepts the display image 260 to determine the significance of the icons.

As an alternative to the server subsystem 200 generating the display image 250 or display image 260, the server subsystem 200 could provide instructions to the client subsystem 100 to generate and display such images. Display image 250 and display image 260 may be random and different each time they are displayed so that a new image is generated for each attempted access in a password or data entry mode.

FIG. 6 further depicts a manner in which the icon location information can be stored by the server subsystem 200 such that for a particular symbol 271 corresponding to an icon ix 230, area descriptions 270 are provided to indicate the location thereof. For example, symbols s0, s1, s2 . . . sn are associated with icons i0-in 230. An area is associated with each icon ix 230 as the area that the icon ix 230 covers. That area is specified, for example, for a rectangular area with the specification of the top-left and bottom-right points, or the top-left point and the width and height of the rectangular area. A circular area might be specified with a center-point and a radius value. Other area specifications for more complex shapes are possible. Additionally, only one point might be stored for each icon, and a minimum distance to closest icon method, or other algorithm, might be used to ascertain the selected icon ix 230.

Each icon ix 230 will have a different set of coordinates defining its particular location on the display image to define area description 270. Points within the selected icon ix 230 on the display locations can be identified by the user through an appropriate input device—such as a computer mouse, pointer, keyboard or the like.

In order to enter the user's password or other data in accordance with the present invention, the appropriate icons i0-in 230 corresponding to the elements of the password are selected in order by the user, and this location information is communicated to the server subsystem 200. In a data entry situation, the server subsystem 200 utilizes a comparator 214 to compare the selected points to the icons i0-in 230 from which they were selected and converts this to the entered data. In a password entry situation, comparator 214 (shown in FIG. 3) in server subsystem 200 compares the order of the points selected by the user to the icon location information which represents the user password elements in the memorized order to determine whether they correspond to each other. If so, the user will be allowed appropriate access to the server subsystem 200.

Comparator 214 may be implemented in server subsystem 200 in software using techniques known in the prior art. Other methods of implementing the comparator are also commonly known in the prior art.

Suppose, for example, that the user's PIN is “5263”. When the user identifies herself to the server subsystem 200, the server subsystem 200 generates a random display image 250 as depicted in FIG. 4 containing a generic background pattern 251 or background leaf pattern 261, and a series of shaped icons i0-in 230 each containing an individual alphanumeric indication. Alternatively, the server subsystem 200 could look up the user's password and generate a series of icons i0-in 230 at least including the password or PIN elements. The icons' locations and features may be generated pseudorandomly, according to a set scheme or obtained from a file, look up table, database or otherwise generated.

As depicted in FIG. 4, the icon shapes may, in one embodiment, be geometric, such as the depicted square, circle, diamond, triangle, and the like, but other non-regular shapes may be utilized. Also, the password may be other than alphanumeric such as fruits, vehicles, animals or other objects. The password may alternatively comprise a series of themes or ideas, such as “hot,” “cold,” “fear,” etc. The icons to such system would comprise images relating to such concepts.

The server subsystem 200 generates the display image 250 depicted in FIG. 4 and transmits that image for display to the user on display device 104. The client subsystem may not know the makeup of the display image 250, but rather may only display that image. The user then selects her PIN or password by identifying in order the particular icons containing the alphanumeric characters containing PIN or password elements. The user selects these, for example, by pointing and clicking through a mouse, or other such pointing device. Alternatively, moving a cursor by means of a keyboard and the entering of each successive image point location in order may be used. Other selection or indication devices and methods may also be used.

With the user's PIN of “5263,” the user would point to and click first the cross, then the circle, then the right triangle and then the square. This will act to select a point in each icon 230 in the form of location information. This location information is then transmitted or communicated to the server in the form, for example, of particular points in the icon 230 such as those listed in the session list 212 in FIG. 7. The server subsystem 200 would compare the selected point locations against the transmitted image locations and determine whether the points correspond to icon locations which indicate the appropriate PIN or password information. If so, the user will be allowed access to the server, as appropriate.

At another session when the same user attempts to sign on and identifies herself to the server subsystem 200, it will generate perhaps another series of icons in a different random pattern on the display, preferably with a different background, and preferably different icon shapes. This will be remembered by the server as a different session list or look-up table. The user will be required to enter the appropriate icon locations that correspond to the password. In this fashion, the actual data or password is neither transmitted from the server to the client, nor from the client to the server.

FIG. 8 shows a flow diagram of a method according to a preferable embodiment of the present invention. In step 802, a display image is generated by a server subsystem containing at least one icon, at least one of which corresponds to relevant data, after a user requests access to a resource. Icon location information and associated data for the generated display image is then stored by the server subsystem in a memory in step 804.

The display image of icons is then transmitted to a client subsystem for display to a user, and the client subsystem receives input from the user indicating the desired icons corresponding to the user's input data in step 806.

The client subsystem then generates selected icon location information in response to said selection of icons by the user in step 808.

The selected icon location information is then transmitted to the server subsystem, which compares said selected icon location information to the stored icon location information and associated data stored for that display image in step 810. Finally, in step 812 the input data entered by the user into the client subsystem is ascertained by the server subsystem by determining the data corresponding to the selected icon location information.

The present invention is flexibly implementable in many and varied circumstances, including for secure entry of credit card information in online shopping applications, for credit-card-operated phones and for applications implemented using smart card technology.

Reference is made to FIGS. 9, 10 and 11. FIG. 9 is a block diagram of an online shopping application on the World Wide Web in which credit cards are used to make purchases. A Web page 802 is generated on display device 914 on client 910. The Web page incorporates a display image 904 containing pseudorandomly generated icons 906. The display image 904 may be transmitted by server 920 over the Internet 930 along with the Web page 902, or server 920 might send instructions to client 910 to generate an image. To enter a credit card number, the user 908 selects the desired icons 230 corresponding to the digits of the user's credit card number by means of input device 912. Client 910 transmits the icon location information 940 to server 920 over the Internet 930. Server 920 compares the icon location information 940 to information stored in memory 924 to ascertain the credit card data entered by user 908. Server 920 can then confirm the credit card information through normal credit card verification processes.

FIG. 10 shows a credit-card-operated phone. A person desiring to use phone 1010 would input the user's credit card information using keypad 1012 depending on the desired icons in display image 1004 on display device 1006 representing said credit card data. The display image 1004 may, as in the Web page example, be generated by the phone 1010 or generated and transmitted by the phone switch 1020 over, in this embodiment, dedicated line 1030. Where the image is generated by the phone switch 1020, icon location information would then be sent by phone 1010 over dedicated line 1030 to phone switch 1020, which compares the received icon location information to information stored in phone switch memory 1024 to ascertain the credit card data. The credit card data is then used to authorize the charge of the phone call using normal credit card authorization processes.

FIG. 11 shows an embodiment of the present invention using smart card technology. User 1108 inserts smart card 1120 into the smart card terminal 1116 of system 1110. The display device 1106 displays a display image 1104 generated by smart card 1120. User 1108 then inputs, using input device 1114, information corresponding to the icons that represent the desired data input. If properly authenticated, the user could, for example, be granted access to a local resource.

An additional enhancement to the present invention can be obtained by implementing a synchronization mechanism such that a display image need not be transmitted between the client and server. One way to implement such a synchronization is to implement pseudorandom number generators in both the client subsystem and server subsystem with both pseudorandom number generators beginning with the same seed. FIG. 12 is a block diagram of an embodiment of the present invention that includes the use of pseudorandom number generators. Each of the client subsystem 1210 and the server subsystem 1220 contain a pseudorandom number generator 1240. By using the pseudorandom number generators 1240, the client subsystem 1210 and the server subsystem 1220 can minimize the amount of information transmitted over communications subsystem 1230. Server subsystem 1220, instead of transmitting an image or sending instructions about an image to be generated (including information about the icons and the data corresponding thereto) to the client subsystem, may send only information about which passes through a pseudorandom number generator function will be used to determine icon location information in a display image to be generated. The client subsystem 1210 and the server subsystem 1220 are preferably synchronized by having preset a particular seed associated with each user. The pseudorandom number generator 1240 will generate the same number every time for a particular pass through the pseudorandom number generator 1240 if the same seed is used, the client subsystem 1210 and the server subsystem 1220 can exploit this characteristic to remain synchronized on every pass.

Part of the advantage provided by the present invention lies in the fact that the visual authentication system is used for secure data entry since recognized ordered transmission and recognition is required. For example, if the icons generated on the display comprise all ten (10) numeric digits from zero through nine, a user might safely enter and transmit his credit card number without actually transmitting the digits themselves, but rather the location information of points in icons corresponding to the digits. Even if this transmission is intercepted, the intercepted information will comprise a location rather than digits so that the interceptor will not learn the user's credit card number. It is noted that encryption techniques may be used to further confound an interceptor even as to the location information.

The invention also incorporates the use of intuitive icons, which assist in confounding computational deciphering techniques. In accordance with the foregoing, the authentication and data entry system of the present invention achieves numerous benefits and advantages. In particular, since the password or data is never itself transmitted, it cannot be intercepted and detected. Moreover, since the password or data entry actions are different each time, the password, credit card information or other data cannot be deduced by an onlooker merely from observation of the user's hands.

The probability of a random guess of a password being correct in a traditional system is 1/(size of alphabet) raised to the power of the number of symbols in the password. For example, with an alphabet of size 10, such as the digits 0 through 9, and a password string of 5 digits, a standard password scheme would give a probability of success of {fraction (1/10)}5 or {fraction (1/100,000)}. Using the system and method of the present invention, the probability of successful guessing at a password is ({fraction (1/100)})5 or {fraction (1/10,000,000,000)}, assuming a 30×30 icon area and a 300×300 image area.

If an encryption scheme is utilized in connection with the present invention and in addition to the present invention, the system is even more secure, and deciphering the encryption will only result in location information, rather than the password or data itself.

The present invention may be used in conjunction with LANs and WANs, secure Internet Web sites, ATM machines, automobile security systems, home security systems, safes and vaults, data encryption and decryption key entry, and other data entry applications. In this regard, it is noted that the references to server side and client side herein do not require a direct communication therebetween. A computer acting as a server could transmit the image to an intermediate computer which could then transmit the image to another computer where the user enters data through the image. Such input is then sent to the intermediate computer and then to the first computer for verification.

It is also noted that the references to server and client also cover a peer-to-peer situation where one computer is used to access or communicate with another. In another situation the image could be generated and stored in a hand-held unit or other such device, and used to enter secure data when in communication, such as through a telephone network, with a source which recognizes the image entries. Additionally, it could be used on page phones or other restricted access phones.

It will thus be seen that the objects set forth above, among those made apparent from the preceding description, are efficiently attained and, since certain changes may be made in carrying out the above methods and in the systems set forth without departing from the spirit and scope of the invention, it is intended that all matter contained in the above description and shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense.

Patent Citations
Cited PatentFiling datePublication dateApplicantTitle
US5276314 *Apr 3, 1992Jan 4, 1994International Business Machines CorporationFor providing access to a secure device
US5428349 *Oct 1, 1992Jun 27, 1995Baker; Daniel G.Nondisclosing password entry system
US5465084 *Sep 22, 1994Nov 7, 1995Cottrell; Stephen R.For limiting access to a device
US5559961 *Aug 30, 1995Sep 24, 1996Lucent Technologies Inc.Graphical password
US5608387 *Nov 30, 1992Mar 4, 1997Davies; John H. E.Personal identification devices and access control systems
US5664099 *Dec 28, 1995Sep 2, 1997Lotus Development CorporationMethod and apparatus for establishing a protected channel between a user and a computer system
US5754785 *Apr 27, 1995May 19, 1998General DatacommCommunications network equipment
US5764913 *Apr 5, 1996Jun 9, 1998Microsoft CorporationComputer network status monitoring system
US5821933 *Sep 14, 1995Oct 13, 1998International Business Machines CorporationComputer system
Non-Patent Citations
Reference
1Constructing a Netword (visited Jul. 1,1997) <http://www.netword.com/n/help/construct.html>.
2Facts About Networds (visited Jul. 1 1997) <http://www.netword.com/n/help/more.html>.
3Keyword Frequently Asked Questions (visited Jul. 21, 1997) <http://www.keyword.com/faqs.htm>.
4Networds in Advertising (visited Jul. 1, 1997) <http://www.netword.com/n/help/nwinads.html>.
5Press Coverage (visited Jul. 21, 1997) <http://www.keyword.com/press.htm>.
6What are Networds? (visited Jul. 1, 1997) <http://www.netword.com/n/help/what.html>.
7What is a Personal Information Page? (visited Jul. 1, 1997) <http://www.netword.com/n/accounts/pips.html>.
8What is keyword.com? (visited Jul. 21, 1997) <http://www.keyword.com/whatis.htm>.
Referenced by
Citing PatentFiling datePublication dateApplicantTitle
US6556224 *Oct 15, 1999Apr 29, 2003Nec CorporationData displaying apparatus which can effectively use data display section of small area
US6601759 *Oct 4, 2001Aug 5, 2003American Express Travel Related ServicesSystem and method for providing feedback in an interactive payment system
US6629246 *Apr 28, 1999Sep 30, 2003Sun Microsystems, Inc.Single sign-on for a network system that includes multiple separately-controlled restricted access resources
US6658574 *Jun 21, 1999Dec 2, 2003International Business Machines CorporationMethod for non-disclosing password entry
US6686931 *Aug 20, 2001Feb 3, 2004Motorola, Inc.Graphical password methodology for a microprocessor device accepting non-alphanumeric user input
US6718471 *Mar 18, 1999Apr 6, 2004Fujitsu LimitedElectronic information management system, ic card, terminal apparatus and electronic information management method, and recording medium on which is recorded an electronic information management program
US6720860 *Jun 30, 2000Apr 13, 2004International Business Machines CorporationPassword protection using spatial and temporal variation in a high-resolution touch sensitive display
US6771597 *Jul 31, 1998Aug 3, 2004International Business Machines CorporationMethod and apparatus for transmitting messages
US6862687 *Oct 20, 1998Mar 1, 2005Casio Computer Co., Ltd.Checking device and recording medium for checking the identification of an operator
US6950949 *Oct 8, 1999Sep 27, 2005Entrust LimitedMethod and apparatus for password entry using dynamic interface legitimacy information
US6980081 *May 10, 2002Dec 27, 2005Hewlett-Packard Development Company, L.P.System and method for user authentication
US6981016 *Jun 11, 1999Dec 27, 2005Visage Development LimitedDistributed client/server computer network
US7051067Jan 14, 2000May 23, 2006Sun Microsystems, Inc.Object oriented mechanism for dynamically constructing customized implementations to enforce restrictions
US7073067 *May 7, 2003Jul 4, 2006Authernative, Inc.Authentication system and method based upon random partial digitized path recognition
US7093282 *Aug 9, 2001Aug 15, 2006Hillhouse Robert DMethod for supporting dynamic password
US7100203 *Apr 19, 2000Aug 29, 2006Glenayre Electronics, Inc.Operating session reauthorization in a user-operated device
US7103910 *Jan 14, 2000Sep 5, 2006Sun Microsystems, Inc.Method and apparatus for verifying the legitimacy of an untrusted mechanism
US7131008Jan 14, 2000Oct 31, 2006Sun Microsystems, Inc.Mechanism for dynamically constructing customized implementations to enforce restrictions
US7188314 *Jan 29, 2003Mar 6, 2007Authernative, Inc.System and method for user authentication interface
US7197646 *Dec 19, 2003Mar 27, 2007Disney Enterprises, Inc.System and method for preventing automated programs in a network
US7219368Mar 23, 2001May 15, 2007Rsa Security Inc.Robust visual passwords
US7240367 *Mar 18, 2003Jul 3, 2007Seoung-Bae ParkUser interface and method for inputting password and password system using the same
US7243239 *Jun 28, 2002Jul 10, 2007Microsoft CorporationClick passwords
US7266693Feb 13, 2007Sep 4, 2007U.S. Bancorp Licensing, Inc.Validated mutual authentication
US7278017 *Jun 7, 2001Oct 2, 2007Anoto AbMethod and device for secure wireless transmission of information
US7278024 *Jul 16, 2003Oct 2, 2007Intel CorporationSession authentication using temporary passwords
US7320033 *Jul 27, 2001Jan 15, 2008Intel CorporationDynamic local drive and printer sharing
US7350078 *Mar 4, 2002Mar 25, 2008Gary OdomUser selection of computer login
US7441122May 26, 2004Oct 21, 2008Bouygues TelecomMethod for providing secure access to a digital resource
US7453443Jun 16, 2003Nov 18, 2008Nokia CorporationMethod of deactivating lock and portable electronic device
US7539874 *May 20, 2004May 26, 2009International Business Machines CorporationSecure password entry
US7549170 *Apr 30, 2003Jun 16, 2009Microsoft CorporationSystem and method of inkblot authentication
US7574739 *Sep 28, 2004Aug 11, 2009Nec CorporationPassword authenticating apparatus, method, and program
US7577987 *Mar 3, 2003Aug 18, 2009Authernative, Inc.Operation modes for user authentication system based on random partial pattern recognition
US7593000Dec 24, 2008Sep 22, 2009David H. ChinTouch-based authentication of a mobile device through user generated pattern creation
US7596701Jan 25, 2006Sep 29, 2009Oracle International CorporationOnline data encryption and decryption
US7616764Jun 29, 2005Nov 10, 2009Oracle International CorporationOnline data encryption and decryption
US7617157 *Jan 3, 2002Nov 10, 2009The Western Union CompanyMethod for receiving electronically transferred funds using an automated teller machine
US7627904 *Sep 29, 2003Dec 1, 2009Nokia CorporationMethod and arrangement for controlling locking function
US7644433 *Dec 23, 2002Jan 5, 2010Authernative, Inc.Authentication system and method based upon random partial pattern recognition
US7673792Apr 26, 2006Mar 9, 2010The Western Union CompanyMethod and system for performing money transfer transactions
US7689831Aug 29, 2005Mar 30, 2010Passrules Canadian Security Inc.Method and system for securing interface access via visual array paths in combination with hidden operators
US7715600Oct 31, 2003May 11, 2010Applied Neural Technologies LimitedSystem for and method of web signature recognition system based on object map
US7725388 *May 5, 2003May 25, 2010Hewlett-Packard Development Company, L.P.Verification of electronic financial transactions
US7725725Dec 23, 2006May 25, 2010Gary OdomUser-selectable signatures
US7734911May 31, 2006Jun 8, 2010Tricipher, Inc.Secure login using augmented single factor split key asymmetric cryptography
US7734912May 31, 2006Jun 8, 2010Tricipher, Inc.Secure login using single factor split key asymmetric cryptography and an augmenting factor
US7734929 *Apr 30, 2004Jun 8, 2010Hewlett-Packard Development Company, L.P.Authorization method
US7734930 *Jul 9, 2007Jun 8, 2010Microsoft CorporationClick passwords
US7735121 *Jan 7, 2003Jun 8, 2010Masih MadaniVirtual pad
US7735124Mar 24, 2005Jun 8, 2010Chyi-Yeu LinPassword input and verification method
US7770209Sep 19, 2006Aug 3, 2010Ebay Inc.Method and system to detect human interaction with a computer
US7822990Dec 22, 2005Oct 26, 2010Oracle International CorporationOnline data encryption and decryption
US7840634 *Jun 26, 2001Nov 23, 2010Eastman Kodak CompanySystem and method for managing images over a communication network
US7849321 *Aug 23, 2006Dec 7, 2010Authernative, Inc.Authentication method of random partial digitized path recognition with a challenge built into the path
US7895437May 31, 2006Feb 22, 2011Vmware, Inc.Augmented single factor split key asymmetric cryptography-key generation and distributor
US7904947Mar 22, 2007Mar 8, 2011Glynntech, Inc.Gateway log in system with user friendly combination lock
US7908645Apr 28, 2006Mar 15, 2011Oracle International CorporationSystem and method for fraud monitoring, detection, and tiered user authentication
US7949879Apr 22, 2009May 24, 2011International Business Machines CorporationSecure password entry
US7954148 *Dec 21, 2009May 31, 2011Bolique Applications Ltd., L.L.C.Encryption and authentication systems and methods
US7965173 *Aug 15, 2008Jun 21, 2011Huether SvenMethod system for simplified identification of an object using a transponder
US7992007 *Feb 5, 2003Aug 2, 2011Cardinalcommerce CorporationDynamic pin pad for credit/debit/ other electronic transactions
US8006299 *Mar 19, 2007Aug 23, 2011Bolique Applications Ltd., L.L.C.Encryption and authentication systems and methods
US8041954Nov 28, 2007Oct 18, 2011Paul PlesmanMethod and system for providing a secure login solution using one-time passwords
US8042159Mar 15, 2007Oct 18, 2011Glynntech, Inc.Website log in system with user friendly combination lock
US8056122 *May 26, 2003Nov 8, 2011Fasoo.Com Co., Ltd.User authentication method and system using user's e-mail address and hardware information
US8090201 *Aug 13, 2007Jan 3, 2012Sony Ericsson Mobile Communications AbImage-based code
US8111134May 26, 2009Feb 7, 2012Visa International Service AssociationDevice including authentication glyph
US8112817 *Oct 22, 2007Feb 7, 2012Girish ChiruvoluUser-centric authentication system and method
US8117458Feb 21, 2008Feb 14, 2012Vidoop LlcMethods and systems for graphical image authentication
US8159327May 13, 2009Apr 17, 2012Visa International Service AssociationDevice including authentication glyph
US8174503May 17, 2008May 8, 2012David H. CainTouch-based authentication of a mobile device through user generated pattern creation
US8191126 *May 4, 2009May 29, 2012Indian Institute Of Technology MadrasMethods and devices for pattern-based user authentication
US8239937 *Dec 16, 2005Aug 7, 2012Pinoptic LimitedUser validation using images
US8271382Sep 29, 2011Sep 18, 2012The Western Union CompanySystems and methods of introducing and receiving information across a computer network
US8307424 *Jan 15, 2009Nov 6, 2012Shibaura Institute Of TechnologyPassword authentication apparatus and password authentication method
US8336086 *Apr 21, 2008Dec 18, 2012Rsupport Co., Ltd.Authentication method using icon password
US8341699Aug 2, 2010Dec 25, 2012Ebay, Inc.Method and system to detect human interaction with a computer
US8370637 *Apr 21, 2010Feb 5, 2013Masih MadaniVirtual pad
US8392846 *Jan 28, 2010Mar 5, 2013Gilbarco, S.R.L.Virtual pin pad for fuel payment systems
US8402372 *May 11, 2010Mar 19, 2013Synaptics IncorporatedTouch screen with user interface enhancement
US8417956Aug 22, 2011Apr 9, 2013Bolique Applications Ltd., L.L.C.Encryption and authentication systems and methods
US8429415Apr 13, 2010Apr 23, 2013Tierra Intelectual BorinquenUser-selectable signatures
US8447118 *Dec 21, 2010May 21, 2013Inventec CorporationMethod of cipher and picture cipher system
US8447272Nov 24, 2010May 21, 2013Visa International Service AssociationAuthentication and human recognition transaction using a mobile device with an accelerometer
US8458485Jun 17, 2009Jun 4, 2013Microsoft CorporationImage-based unlock functionality on a computing device
US8484455Sep 14, 2010Jul 9, 2013Oracle International CorporationOnline data encryption and decryption
US8505071 *May 30, 2007Aug 6, 2013Disney Enterprises, Inc.Preventing automated programs and unauthorized users in a network
US8505826Apr 16, 2007Aug 13, 2013Visa U.S.A.Anti-interrogation for portable device
US8554685Jan 31, 2012Oct 8, 2013Visa International Service AssociationMethod and system using universal ID and biometrics
US8560947May 11, 2010Oct 15, 2013Synaptics IncorporatedTouch screen with user interface enhancement
US8564555Apr 29, 2010Oct 22, 2013Synaptics IncorporatedOperating a touch screen control system according to a plurality of rule sets
US8589300Jun 11, 2012Nov 19, 2013Visa U.S.A. Inc.Payment transaction using mobile phone as relay
US8607331 *Sep 13, 2011Dec 10, 2013Industrial Technology Research InstituteCaptcha image authentication method and system
US8621047Oct 13, 2010Dec 31, 2013Intellectual Ventures Fund 83 LlcSystem and method for managing images over a communication network
US8621242Oct 14, 2010Dec 31, 2013Arm LimitedDisplay of a verification image to confirm security
US8621578Dec 10, 2008Dec 31, 2013Confident Technologies, Inc.Methods and systems for protecting website forms from automated access
US8624842Aug 27, 2009Jan 7, 2014Gemalto SaProjected and secured virtual keyboard
US8631487Dec 16, 2010Jan 14, 2014Research In Motion LimitedSimple algebraic and multi-layer passwords
US8635676Dec 16, 2010Jan 21, 2014Blackberry LimitedVisual or touchscreen password entry
US8650624Dec 16, 2010Feb 11, 2014Blackberry LimitedObscuring visual login
US8650635Dec 16, 2010Feb 11, 2014Blackberry LimitedPressure sensitive multi-layer passwords
US8650636Jun 17, 2011Feb 11, 2014Microsoft CorporationPicture gesture authentication
US8653941Mar 5, 2012Feb 18, 2014Visa International Service AssociationDevice including authentication glyph
US8661530Dec 16, 2010Feb 25, 2014Blackberry LimitedMulti-layer orientation-changing password
US8682395 *Jan 27, 2012Mar 25, 2014Blackberry LimitedCommunications device and method having non-touch based input screen
US8682798Sep 23, 2011Mar 25, 2014Visa International Service AssociationMethod and system using universal ID and biometrics
US8694793Dec 11, 2007Apr 8, 2014Visa U.S.A. Inc.Biometric access control transactions
US8739278Oct 29, 2008May 27, 2014Oracle International CorporationTechniques for fraud monitoring and detection using application fingerprinting
US8745694Dec 16, 2010Jun 3, 2014Research In Motion LimitedAdjusting the position of an endpoint reference for increasing security during device log-on
US20090002333 *Jun 19, 2008Jan 1, 2009Chumby Industries, Inc.Systems and methods for device registration
US20090328197 *Dec 16, 2005Dec 31, 2009Mark Dwight NewellUser validation using images
US20100011419 *Apr 21, 2008Jan 14, 2010Rsupport Co., Ltd.Authentication method using icon password
US20100275033 *May 11, 2010Oct 28, 2010Synaptics IncorporatedTouch screen with user interface enhancement
US20100322485 *Jun 15, 2010Dec 23, 2010Research In Motion LimitedGraphical authentication
US20110077850 *Jul 23, 2010Mar 31, 2011Aisin Aw Co., Ltd.Navigation device, method and program
US20110113388 *Apr 22, 2009May 12, 2011The 41St Parameter, Inc.Systems and methods for security management based on cursor events
US20110185138 *Aug 12, 2009Jul 28, 2011Research In Motion LimitedMethod and apparatus for controlling access to a computing device
US20110185319 *Jan 28, 2010Jul 28, 2011Giovanni CarapelliVirtual pin pad for fuel payment systems
US20110227837 *Aug 10, 2010Sep 22, 2011E Ink Holdings Inc.Electromagnetic touch displayer
US20110239272 *Mar 24, 2010Sep 29, 2011Ebay Inc.Non-numeric personal identification
US20110288965 *Aug 1, 2011Nov 24, 2011Cardinalcommerce CorporationDynamic pin pad for credit/debit/ other electronic transactions
US20110307952 *Nov 24, 2010Dec 15, 2011Hon Hai Precision Industry Co., Ltd.Electronic device with password generating function and method thereof
US20120005734 *Sep 15, 2011Jan 5, 2012Passlogy Company Ltd.User authentication method and user authentication system
US20120128258 *Dec 21, 2010May 24, 2012Inventec CorporationDesign method of cipher and picture cipher system
US20120216291 *Feb 22, 2012Aug 23, 2012Htc CorporationData security management systems and methods
US20130007875 *Jun 30, 2011Jan 3, 2013Ebay, Inc.Interactive CAPTCHA
US20130167225 *Dec 21, 2011Jun 27, 2013Ted SANFTGraphical image password authentication method
US20130196716 *Jan 27, 2012Aug 1, 2013Research In Motion LimitedCommunications device and method having non-touch based input screen
US20140044364 *Apr 25, 2011Feb 13, 2014Melih AbdulhayogluMethod of Image Identification Based on Artificial Intelligence
CN100565451CJun 27, 2003Dec 2, 2009电子湾有限公司Method and system for monitoring user interaction with a computer
CN101057444BSep 9, 2004Feb 29, 2012奥瑟内蒂夫公司Authentication system and method based on random partial digitized path recognition
DE102004058277B3 *Dec 2, 2004Jun 14, 2006Bdt-Solutions GmbhResponse generating method e.g. for Challenge-Response-Method via network, involves using client computer and server computer with server computer is spam email recognition server
EP1434408A2 *Dec 19, 2003Jun 30, 2004Authenture, Inc.Authentication system and method based upon random partial pattern recognition
EP1540468A1 *Jun 27, 2003Jun 15, 2005eBay, Inc.Method and system for monitoring user interaction with a computer
EP1574931A2 *Mar 3, 2005Sep 14, 2005Wincor Nixdorf International GmbHSelf-service device with a data imput device and method for inquiring the PIN
EP1708110A1Mar 22, 2005Oct 4, 2006Lin, Chyi-YeuPassword input and verification method
EP1723608A1 *Feb 11, 2005Nov 22, 2006Yuen Chen LimMethod for protecting a character entered at a graphical interface
EP1845474A1Apr 12, 2006Oct 17, 2007Vince YangA method for verifying authorized access
EP1898334A2 *Aug 21, 2007Mar 12, 2008Authernative, Inc.Authentication method of random partial digitized path recognition with a challenge built into the path
EP2189884A1 *Nov 18, 2008May 26, 2010Gemalto SAProjected and secured virtual keyboard
EP2455883A1 *Mar 29, 2011May 23, 2012Rakuten, Inc.Authentication server device, authentication server device-use program and authentication method
WO2003046683A2 *Oct 22, 2002Jun 5, 2003Heartland Payment Systems IncApparatus and method for downloading configuration data
WO2003046730A2 *Nov 28, 2002Jun 5, 2003Bouygues Telecom SaMethod for making secure access to a digital resource
WO2003048909A2Nov 27, 2002Jun 12, 2003Applied Neural Computing L L CValidating the identity of a user using a pointing device
WO2003049001A2 *Oct 30, 2002Jun 12, 2003Thomas GebelMethod for graphical authentication
WO2004001560A1 *Jun 16, 2003Dec 31, 2003Nokia CorpMethod of deactivating lock, and portable electronic device
WO2004027632A1 *Aug 9, 2003Apr 1, 2004Crtptzone LtdMethod and system for processing password inputted by the matching of cells
WO2005062775A2 *Dec 16, 2004Jul 14, 2005Disney Entpr IncSystem and method for preventing automated programs in a network
WO2006031212A1 *Sep 9, 2004Mar 23, 2006Authernative IncAuthentication system and method based upon random partial digitized path recognition
WO2006064241A2 *Dec 16, 2005Jun 22, 2006Mark Dwight BedworthUser validation using images
WO2006073313A1 *Jan 5, 2006Jul 13, 2006Lumex AsMethod and system for authenticating information entered into computer systems
WO2006138221A1 *Jun 13, 2006Dec 28, 2006Stelor Productions LlcA system and method for establishing and authorizing a security code
WO2007056476A2 *Nov 9, 2006May 18, 2007Todd CarperDevice providing a secure work environment and utilizing a virtual interface
WO2007098569A1 *Mar 1, 2006Sep 7, 2007Norman Frank GoertzenMethod and system for securing interface access via visual array paths in combination with hidden operators
WO2008029059A2 *Sep 5, 2007Mar 13, 2008France TelecomSecuring of code for personal entity
WO2008087570A2 *Jan 10, 2008Jul 24, 2008Koninkl Philips Electronics NvNetwork configuration via a wireless device
WO2008105602A1 *Feb 25, 2008Sep 4, 2008Min Su KimUser authentication method and system using graphic otp
WO2009017751A1 *Jul 30, 2008Feb 5, 2009Caterpillar IncUser authentication with image password
WO2010026591A1 *Sep 6, 2009Mar 11, 2010Walletex Microelectronics Ltd.Method and apparatus for carrying out secure electronic communication
WO2010056961A2 *Nov 13, 2009May 20, 2010Visa International Service AssociationDevice including authentication glyph
WO2010057692A1 *Aug 27, 2009May 27, 2010Gemalto SaProjected and secured virtual keyboard
WO2011117632A1 *Mar 23, 2011Sep 29, 2011Passfaces CorporationMethod and system for authenticating user access to a restricted resource across a computer network
Classifications
U.S. Classification726/18, 340/5.8, 705/44
International ClassificationG06F21/00
Cooperative ClassificationG06Q20/40, G06F21/36
European ClassificationG06F21/36, G06Q20/40
Legal Events
DateCodeEventDescription
Mar 11, 2014ASAssignment
Owner name: SILICON VALLEY BANK, CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:ACCULLINK, INC.;REEL/FRAME:032404/0605
Effective date: 20140307
Mar 10, 2014ASAssignment
Owner name: SILICON VALLEY BANK, CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:ACCULLINK, INC.;REEL/FRAME:032396/0314
Effective date: 20140307
Mar 21, 2013FPAYFee payment
Year of fee payment: 12
Mar 21, 2013SULPSurcharge for late payment
Year of fee payment: 11
Nov 5, 2012REMIMaintenance fee reminder mailed
Oct 22, 2010ASAssignment
Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:SILICON VALLEY BANK;REEL/FRAME:025178/0620
Effective date: 20101020
Owner name: ACCULLINK INC, GEORGIA
May 5, 2010ASAssignment
Owner name: SILICON VALLEY BANK,CALIFORNIA
Free format text: SECURITY AGREEMENT;ASSIGNOR:ACCULLINK, INC.;US-ASSIGNMENT DATABASE UPDATED:20100505;REEL/FRAME:24337/1
Effective date: 20100423
Free format text: SECURITY AGREEMENT;ASSIGNOR:ACCULLINK, INC.;REEL/FRAME:024337/0001
Owner name: SILICON VALLEY BANK, CALIFORNIA
Mar 26, 2009SULPSurcharge for late payment
Year of fee payment: 7
Mar 26, 2009FPAYFee payment
Year of fee payment: 8
Oct 6, 2008REMIMaintenance fee reminder mailed
Apr 25, 2008ASAssignment
Owner name: ACCULLINK, LLC, GEORGIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SOLIDUS NETWORKS, INC.;REEL/FRAME:020845/0814
Effective date: 20080229
Dec 19, 2007ASAssignment
Owner name: THE BANK OF NEW YORK, AS AGENT, AS SECURED PARTY,
Free format text: GRANT OF PATENT SECURITY INTEREST;ASSIGNOR:SOLIDUS NETWORKS, INC.;REEL/FRAME:020270/0594
Effective date: 20071219
Feb 16, 2006ASAssignment
Owner name: THE BANK OF NEW YORK, AS COLLATERAL AGENT, TEXAS
Free format text: GRANT OF PATENT SECURITY INTEREST (UNDER THE AMENDED AND RESTATED PATENT SECURITY AGREEMENT);ASSIGNOR:SOLIDUS NETWORKS, INC.;REEL/FRAME:017176/0389
Effective date: 20060216
Jan 26, 2006ASAssignment
Owner name: SOLIDUS NETWORKS, INC., D/B/A PAY BY TOUCH, CALIFO
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:JALILI, REZA;REEL/FRAME:017065/0754
Effective date: 20060123
Sep 22, 2004FPAYFee payment
Year of fee payment: 4